Limited-Time Offer

Get Extra 20% off on FullCharge Yearly Plan — available for first 10 users only. Don’t miss out! 🚀

TrackWP

Members · Version history

Members changelog and version history

Latest version
3.3.1
Oct 30, 2026 (10 days ago)
Releases
69
since 2009
In the last year
12
about one every 24 days
Tested up to
WordPress 7.1.4
PHP 8.0 or later

Releases each year

  • 20092 releases
  • 20111 release
  • 20122 releases
  • 20132 releases
  • 20155 releases
  • 20162 releases
  • 20174 releases
  • 20181 release
  • 20191 release
  • 202015 releases
  • 20214 releases
  • 20223 releases
  • 20236 releases
  • 20247 releases
  • 20252 releases
  • 202612 releases

202612 releases

  1. Members 3.3.1Latest

    • Changed: Now requires PHP 8.0 minimum.
    • Security: Content Permissions now protect posts shown in the Latest Posts block’s full-content mode. Thanks to Nathan Cross (CyberBadger) for reporting this.
    • Security: Comments on restricted posts are now hidden in the Latest Comments block. Thanks to Nathan Cross (CyberBadger) for reporting this.
    • Security: Fixed a fatal error when a Block Permissions block was saved with an invalid message or capability. Thanks to Nathan Cross (CyberBadger) for reporting this.

  2. Members 3.3.0

    • New: AI assistants (MCP). Claude Desktop, Claude Code, Cursor, VS Code, OpenAI Codex and other MCP apps can look up and manage roles, capabilities, users’ roles, content restrictions, settings and add-ons (plus Admin Access, Role Hierarchy, Role Levels and Block Permissions when those add-ons are o…
    • New: AI (MCP) settings tab with one-click MCP Adapter install, one-click Application Password setup, read-only mode (on by default), on/off switches for each area, and a 90-day activity log.
    • New: Risky AI changes ask “Are you really sure?” first, and changes that would lock you out of your site are always refused.
    • Fixed: Logged-in members could see the “no permission” message on sites that use page caching or a CDN (a regression in 3.2.28).
    • Fixed: Block Permissions now defers to MemberPress when it is active, and Role Hierarchy works for guests.

  3. Members 3.2.28

    • Fixed: Redirect loop on private sites when the login page has been moved (e.g. WP Ghost).
    • Fixed: The [members_login_form] shortcode now works with two-factor authentication plugins such as Wordfence.
    • Fixed: Content Permissions now protect pages built with Bricks Builder.
    • Fixed: Fatal error on Roles → Editable when a role is added after roles are initialized.
    • Fixed: Several bugs in the bundled add-ons (Admin Access, Reset Roles, Category & Tag Caps, Core Create Caps, and more).
    • Changed: The block editor Content Permissions panel now saves through its own REST route, so page builders can no longer overwrite its settings.
    • Fixed: With MemberPress active, Block Permissions no longer shows an “add MemberPress” prompt or offers options only MemberPress can enforce; it points to MemberPress’ own Content Protection panel when that panel is on the block.
    • Fixed: The Role Hierarchy add-on no longer stops front-end registration forms from assigning the role they’re set to.
    • Removed: The [avatar] and [get_avatar] shortcodes, deprecated since 0.2.0, which output nothing. Posts that still contain them will show the shortcode as text.
    • Removed: The Login Form widget’s undocumented redirect instance setting, which had no field on the widget screen. Code that passed it to the_widget() now gets the default (back to the current page).
    • Other bug fixes and improvements.

  4. Members 3.2.27

    • Security: Hardened the add-on settings so only add-ons that ship with Members can be enabled, and invalid saved values are ignored.

  5. Members 3.2.26

    • Fixed: On the user profile / edit-user screen with Multiple User Roles enabled, the role checkboxes could appear to have no checkmark — looking “unresponsive” — when another plugin’s admin CSS overrode core checkbox styles (e.g. line-height: 0). The checkboxes always toggled and saved; only the che…
    • Fixed: Hardened the Multiple User Roles save against a possible PHP 8 TypeError from malformed submitted role data (a nested array reaching members_sanitize_role()).

  6. Members 3.2.25

    • Fixed: Saving a post via the REST API as a user without the restrict_content capability (e.g. custom roles, Gutenberg + ACF Pro) failed with “Sorry, you are not allowed to edit the _members_access_role custom field,” and silently dropped other meta such as ACF fields. The request pre-processor was…
    • Fixed: The REST protected-posts exclusion scoped its restriction lookup to the queried post type, so posts inheriting a restriction from an ancestor of a different post type were not excluded, making X-WP-Total / pagination counts inaccurate. All restriction roots are now considered regardless of p…
    • Fixed: Content Permissions role configuration and the custom error message were visible in REST API responses to any user who could read the post (registered meta is readable regardless of its write auth callback). Both meta keys are now blanked to their empty defaults in REST responses for users w…
    • Fixed: Comments on role-protected posts were fully readable — bodies, author names, dates — via the REST API comments endpoint (/wp/v2/comments), including by anonymous visitors. Comment collections now exclude protected posts and single-comment reads are denied for users who cannot view the post.
    • Fixed: With “Hide protected posts from REST API” enabled, hidden posts remained enumerable by ID — a single-item GET (/wp/v2/posts/ID) returned a 200 response exposing the title, slug, date, and author. Hidden posts now return the same 404 as a nonexistent ID.
    • Fixed: A crafted form submission with nested array values could cause a PHP 8 TypeError fatal in the classic Content Permissions meta box save.
    • Fixed: Evaluating protected posts for the REST exclusion no longer triggers the legacy _role meta conversion, which performed database writes during unauthenticated GET requests and could destructively migrate _role postmeta belonging to unrelated plugins. The evaluation is now read-only and also g…
    • Fixed: The block editor “Error Message” field in the Content Permissions panel was a rich-text control used outside a block context, so it silently ignored Enter and formatting — a multi-line message could not be entered. It is now a standard multi-line text field.
    • Fixed: Opening a brand-new post in the block editor marked it as having unsaved changes before the user touched anything, because default roles were written to post meta on load. Default roles are now shown pre-selected without dirtying the editor, and persist normally once the post is edited.
    • Fixed: Content Permissions REST meta and its block editor save now also register on rest_api_init, so post types registered later than other plugins/themes no longer show a Content Permissions panel that fails to save.
    • Fixed: Content Permissions can once again be enabled for attachments via the members_enable_attachment_content_permissions filter (a 3.2.22 change returned early for attachments before the filter ran).
    • Fixed: Saving the classic Content Permissions meta box no longer drops stored roles that were hidden from the checklist by the members_wp_roles filter; those roles are now preserved like deleted-role (orphan) slugs.
    • Changed: The REST protected-posts exclusion scopes its permission checks to the queried post type(s) — restriction roots of other post types are only evaluated when they can actually pass a restriction down to the queried type — computes its hidden-post list once per request per user and type combi…

  7. Members 3.2.24

    • Fixed: Content Permissions could not be saved via the REST API (block editor, Elementor, and other page builders) in 3.2.23, failing with “Sorry, you are not allowed to edit the _members_access_role custom field.” The meta auth callback wrongly honored WordPress’ default deny for protected meta key…
    • Fixed: The 3.2.23 REST protected-posts exclusion (CVE-2026-12426 fix) generated deeply nested correlated subqueries that caused severe database load and timeouts on large sites. It is now resolved to a flat list of excluded IDs computed in PHP.
    • Fixed: The same REST exclusion query could exceed MySQL’s join/subquery limits and return zero posts even when nothing was restricted. Pagination counts remain accurate and the side channel stays closed.

  8. Members 3.2.23

    • Fixed: Unauthenticated sensitive information disclosure via a REST API pagination side channel (CVE-2026-12426). Protected posts are now excluded from REST queries at the SQL level so the result counts and pagination headers no longer reveal hidden posts.
    • Fixed: REST API and block editor hangs when saving posts that use content permissions. Content permissions handling in the block editor was reworked for reliable saving.
    • Fixed: Custom capability creation could break when a role’s hidden capabilities were not stored as an array.
    • Fixed: Trailing space in the members_show_roles_page_cap filter name that prevented the filter from ever firing.
    • Changed: Optimized role user counting on sites with large numbers of users to reduce database load.
    • Changed: Refactored the login widget to use get_current_user_id() for improved security and maintainability.

  9. Members 3.2.22

    • Added import/export feature
    • Added capabilities search
    • Ensure WP 7.0 Compat

  10. Members 3.2.21

    • Fixed: Privacy Caps add-on not granting privacy capabilities to administrators on fresh activations
    • Removed: Legacy standalone-plugin code from bundled add-ons (dead activation hooks, obsolete build scripts, orphaned readme/uninstall files)

  11. Members 3.2.20

    • Added: Reset roles
    • Added: Add rescue link for Administrator roles only
    • Changed: Refreshed branding with updated WordPress.org banner and icon assets, header SVG, and logo
    • Changed: Updated About page design
    • Changed: Optimized role user count retrieval using transients for improved performance
    • Fixed: Missing header banner on some admin pages
    • Removed: Bundled POT file (translations now delivered via WordPress.org language packs)

  12. Members 3.2.19

    • Fixed: Added support for WF 2FA error messages
    • Fixed: Missing “you are already logged in” string
    • Fixed: Add-on page RTL CSS fix
    • Fixed: Block permissions fixes
    • Fixed: Fix redirect_to issue on shortcode
    • Fixed: Other minor bugfixes

20252 releases

  1. Members 3.2.18

    • Fixed: Add-on activate toggle display issue on narrow screens
    • Fixed: Login error redirection
    • Fixed: Outdated Login form styling
    • Fixed: Allow changing display name for some Roles

  2. Members 3.2.17

    • Added: Bulk select/unselect checkboxes on Role capabilities

20247 releases

  1. Members 3.2.16

    • Fixed: Protected posts being forced-hidden from API search even if setting was off

  2. Members 3.2.15

    • Added: Growth Tools menu item
    • Fixed: Translation errors
    • Fixed: Styles and formatting on add-ons and about pages

  3. Members 3.2.14

    • Fixed: Error in REST API calls when posts results not an array

  4. Members 3.2.12

    • Fixed: Cleaned up prior author name and links
    • Fixed: Cleaned up broken or incorrect links
    • Fixed: Removed some unnecessary files
    • Fixed: Incorrect gettext calls
    • Fixed: Removed unneeded load_plugin_textdomain calls
    • Fixed: Updated POT translation file

  5. Members 3.2.11

    • Fixed: Translation warnings after WP 6.7
    • Fixed: Add option to hide protected content from REST API searches
    • Fixed: Add support for Loco Translate plugin (via new loco.xml file)

  6. Members 3.2.10

    • Fixed: Capability checks on AJAX calls
    • Fixed: PHP warning for $wp_embed
    • Changed: Now requires PHP 7.4 minimum

  7. Members 3.2.9

    • Fixed: PHP 8.1 deprecation notice on ACF integration (props @DSGND)

20236 releases

  1. Members 3.2.8

    • Added: members_wp_roles filter to WP roles in Content Permission box
    • Fixed: Content Permission icon in Panel block
    • Fixed: Position of Field Group menu item in ACF

  2. Members 3.2.7

  3. Members 3.2.6

  4. Members 3.2.5

    • Fixed: WP Cron task for in-plugin notifications running unnecessarily

  5. Members 3.2.4

    • Fixed: More package deployment fixes

  6. Members 3.2.3

    • Added: Footer with helpful links
    • Fixed: Package files deployed unnecessarily
    • Fixed: Debug warnings
    • Fixed: Correct bootstrap file required

20223 releases

  1. Members 3.2.2

  2. Members 3.2.1

  3. Members 3.2.0

20214 releases

  1. Members 3.1.7

  2. Members 3.1.6

  3. Members 3.1.5

  4. Members 3.1.4

202015 releases

  1. Members 3.1.3

  2. Members 3.1.2

  3. Members 3.1.1

  4. Members 3.1.0

  5. Members 3.0.10

  6. Members 3.0.9

  7. Members 3.0.8

  8. Members 3.0.7

  9. Members 3.0.6

  10. Members 3.0.5

  11. Members 3.0.4

  12. Members 3.0.3

  13. Members 3.0.2

  14. Members 3.0.1

  15. Members 3.0.0

20191 release

  1. Members 2.2.0

20181 release

  1. Members 2.1.0

20174 releases

  1. Members 2.0.2

  2. Members 2.0.1

  3. Members 2.0.0

  4. Members 1.1.3

20162 releases

  1. Members 1.1.2

  2. Members 1.1.1

20155 releases

  1. Members 1.1.0

  2. Members 1.0.2

  3. Members 1.0.1

  4. Members 1.0.0

  5. Members 0.2.5

20132 releases

  1. Members 0.2.4

  2. Members 0.2.3

20122 releases

  1. Members 0.2.2

  2. Members 0.2.1

20111 release

  1. Members 0.2

20092 releases

  1. Members 0.1.1

  2. Members 0.1

Questions about Members’s releases

What is the latest version of Members?

3.3.1, released on Oct 30, 2026 (1 week ago). It’s tested up to WordPress 7.1.4 and needs PHP 8.0 or later.

How often is Members updated?

12 releases in the last year, about one every 24 days. Its first release on WordPress.org dates from September 2009.

Know when your rivals ship

Track your plugin and its rivals: TrackWP sees each new release in the nightly snapshot and alerts you, with what it did to their rank.

Start free

Release dates come from the day each version’s folder was made in Members’s WordPress.org SVN repository; the notes from its readme’s changelog, as its authors wrote it.